domainfree: find the domains you can actually register

[ralyodio]

Adds domainfree — find the domains you can actually register — and a domain plugin so it's available in moshcode.

Ported from the bash version in profullstack/scripts to this repo's conventions.

Why RDAP and not dig

DNS cannot tell registration apart from configuration:

• a parked domain resolves fine and is taken
• a domain registered with no nameservers returns NXDOMAIN — exactly what a name nobody owns returns

Over 8,513 generated candidates, dig NAME | grep "ANSWER: 0" reported 20 registered domains as free, and missed none that were genuinely free.

oubliette.com is the one to remember: registered in 1996, paid through 2034, three nameservers, no A record — so dig returns ANSWER: 0 and it reads as available.

Fine as a cheap prefilter. Wrong as a buy signal.

Usage

domainfree sorrycheck.com sinkstate.com
domainfree --file candidates.txt
generate-names | domainfree --jobs 24
domainfree --all example.com        # show TAKEN rows too

Only available names go to stdout; the summary goes to stderr, so domainfree -f in.txt | wc -l counts what you can buy. ~8,500 names in ~45s at the default concurrency.

An indeterminate response is never reported as available. A 429, 5xx or timeout is retried once, then reported as ERR:<code>, and the exit status is 2. A name wrongly reported free is the only failure mode here that costs real time.

Plugin

New domain plugin, registered in the marketplace next to blog:

• /domain:free — filter a list down to registerable names
• /domain:lookup — everything about one name, wrapping the existing domainjson

moshcode plugin marketplace add profullstack/cli-tools
moshcode plugin install domain@cli-tools

Layout

Follows the repo: logic in src/domain-free.ts with an injectable fetcher, a thin bin/ entry guarded by isMain, args through the shared parseArgs, .ts import specifiers, vitest tests that touch no network.

One thing worth flagging

My first version of these tests used real setTimeout delays, and that added wall-clock load made blog.test.ts's concurrent-createPost race test fail — it passed alone but failed in the full suite. That test is timing-sensitive and this change happened to expose it.

I didn't touch it. Instead checkMany's retry pause is now injectable (retryDelayMs), the tests pass 0, and no test in this file uses a real timer. Full suite is green across four consecutive runs (82/82).

Worth knowing separately: blog.test.ts asserts that two concurrent creates produce exactly one success and one EEXIST. Under different scheduling both can succeed with different numbers, so it may resurface as other test files are added.

Verified

• pnpm test — 82/82, four consecutive runs
• pnpm typecheck — clean
• CLI exercised for real: args, stdin, --file, --all, non-.com routing, case/whitespace normalisation, junk filtering, --help/bad-flag/invalid-value exit codes
• isMain guard confirmed: importing bin/domainfree.ts does not run the tool

Note on installation

install-links.mjs --dry-run currently skips all seven commands, including this one, because ~/.local/bin/* still points at ~/scripts/bin. That's the repo's existing ported-but-not-switched-over state, not something this PR changes. --force takes them over when you want to switch.

There is now a bash domainfree in profullstack/scripts (PR #7) and this TypeScript one — same situation as domainjson. Happy to close the scripts PR if you'd rather this be the only home.

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

3 finding(s)

MEDIUM: 1 | LOW: 2

Severity	Rule	Location
MEDIUM	redos-nested-quantifier	src/domain-free.ts:56
LOW	insecure-temp-file	test/blog.test.ts:58
LOW	insecure-temp-file	test/blog.test.ts:59

Snippets are redacted; ThreatCrush never prints matched credential material.